Merged with master.

Author: AlexeyKuznetsov-DD

.github/chainguard/self.gitlab.release.sts.yaml

@@ -1,11 +1,11 @@
 issuer: https://gitlab.ddbuild.io
 
-subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v.*"
+subject_pattern: 'project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v\d+\.\d+\.\d+'
 
 claim_pattern:
   project_path: "DataDog/apm-reliability/dd-trace-java"
   ref_type: "tag"
-  ref: "v.*"
+  ref: 'v\d+\.\d+\.\d+'
 
 permissions:
   contents: "write"

.github/scripts/dependency_age.py

@@ -551,6 +551,8 @@ def build_validation_summary(
         blocks.append(
             "### :warning: Cannot verify age, reverted\n\n"
             "The age of these dependencies could not be verified, so the lockfiles were reverted. "
+            "This likely means that the following dependencies are published to a repo not yet configured in the workflow. "
+            "If this is the case, add the missing repository as a `--repo-url` in the `Validate changed lock files` step of `.github/workflows/update-gradle-dependencies.yaml`. "
             "**This needs to be resolved manually.**\n\n"
             + "\n".join(sorted(unverified))
         )

.github/workflows/update-gradle-dependencies.yaml

@@ -68,6 +68,9 @@ jobs:
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
             --repo-url "https://repo1.maven.org/maven2" \
             --repo-url "https://repo.akka.io/${AKKA_REPO_TOKEN}/secure" \
+            --repo-url "https://packages.confluent.io/maven" \
+            --repo-url "https://repository.mulesoft.org/releases" \
+            --repo-url "https://repository.mulesoft.org/nexus/content/repositories/public" \
             --github-output "$GITHUB_OUTPUT"
 
       - name: Save instrumentation lock files

.gitlab-ci.yml

@@ -242,8 +242,9 @@ default:
       EOF
     - mkdir -p .gradle
     - export GRADLE_USER_HOME=$(pwd)/.gradle
-    # replace maven central part by MAVEN_REPOSITORY_PROXY in .mvn/wrapper/maven-wrapper.properties
-    - sed -i "s|https://repo.maven.apache.org/maven2/|$MAVEN_REPOSITORY_PROXY|g" .mvn/wrapper/maven-wrapper.properties
+    # Apache Maven Wrapper supports MVNW_REPOURL for repository-manager downloads:
+    # https://maven.apache.org/tools/wrapper/#Using_a_Maven_Repository_Manager
+    - export MVNW_REPOURL=${MAVEN_REPOSITORY_PROXY%/}
     # Route Gradle distribution download through MASS pull-through cache
     - |
       mass_read_host="${MASS_READ_URL#https://}"
@@ -784,7 +785,14 @@ muzzle-dep-report:
     # and Gradle does `chmod 700 .gradle` on startup which requires user ownership.
     - sudo chown -R 1001:1001 .gradle
     - export GRADLE_USER_HOME=$(pwd)/.gradle
-    - sed -i "s|https://repo.maven.apache.org/maven2/|$MAVEN_REPOSITORY_PROXY|g" .mvn/wrapper/maven-wrapper.properties
+    # Apache Maven Wrapper supports MVNW_REPOURL for repository-manager downloads:
+    # https://maven.apache.org/tools/wrapper/#Using_a_Maven_Repository_Manager
+    - export MVNW_REPOURL=${MAVEN_REPOSITORY_PROXY%/}
+    # Route Gradle distribution download through MASS pull-through cache
+    - |
+      mass_read_host="${MASS_READ_URL#https://}"
+      mass_read_host="${mass_read_host%/}"
+      sed -i "/^distributionUrl=/ s|services.gradle.org|${mass_read_host}/internal/artifact/services.gradle.org|" gradle/wrapper/gradle-wrapper.properties
     - *normalize_node_index
     - *prepare_test_env
     # Disable CDS in forked JVMs to avoid SIGSEGVs on Linux arm64.
@@ -1107,6 +1115,7 @@ test_smoke_graalvm:
   needs: *needs_build_tests_smoke
   tags: [ "arch:amd64" ]
   variables:
+    <<: *tier_l_variables
     GRADLE_TARGET: "stageMainDist :dd-smoke-test:spring-boot-3.0-native:test :dd-smoke-test:quarkus-native:test"
     CACHE_TYPE: "smoke"
     CI_NO_SPLIT: "true"
@@ -1119,6 +1128,7 @@ test_smoke_graalvm_arm64:
   extends: .test_job_arm64
   tags: [ "arch:arm64" ]
   variables:
+    <<: *tier_l_variables
     GRADLE_TARGET: "stageMainDist :dd-smoke-test:spring-boot-3.0-native:test :dd-smoke-test:quarkus-native:test"
     CACHE_TYPE: "smoke"
     CI_NO_SPLIT: "true"

.gitlab/java-benchmark-configs.yml

@@ -50,6 +50,10 @@ linux-java-spring-petclinic-load-parallel:
   needs: ["publish-artifacts-to-s3"]
   rules: *parallel_benchmark_rules
 
+linux-java-spring-petclinic-sca-load-parallel:
+  needs: ["publish-artifacts-to-s3"]
+  rules: *parallel_benchmark_rules
+
 linux-java-insecure-bank-startup-parallel:
   needs: ["publish-artifacts-to-s3"]
   rules: *parallel_startup_benchmark_rules

build-logic/smoke-test/src/main/kotlin/datadog/buildlogic/smoketest/NestedGradleBuild.kt

@@ -113,6 +113,11 @@ abstract class NestedGradleBuild @Inject constructor(
   @get:Input
   abstract val buildCacheEnabled: Property<Boolean>
 
+  /** Timeout, in seconds, for stopping the nested Gradle daemon after the build. */
+  @get:Input
+  @get:Optional
+  abstract val stopTimeoutSeconds: Property<Long>
+
   /**
    * Extra environment variables for the nested Gradle daemon. Merged on top of the outer process
    * environment; Gradle launcher variables are reserved by this task so nested builds do not
@@ -236,9 +241,17 @@ abstract class NestedGradleBuild @Inject constructor(
       }
 
       val process = processBuilder.start()
-      if (!process.waitFor(GRADLE_STOP_TIMEOUT_SECONDS, TimeUnit.SECONDS)) {
+      val timeoutSeconds = stopTimeoutSeconds.orNull
+      val completed =
+        if (timeoutSeconds == null) {
+          process.waitFor()
+          true
+        } else {
+          process.waitFor(timeoutSeconds, TimeUnit.SECONDS)
+        }
+      if (!completed) {
         process.destroyForcibly()
-        logger.warn("Timed out while stopping nested Gradle daemon")
+        logger.warn("Timed out after {} seconds while stopping nested Gradle daemon", timeoutSeconds)
         return
       }
       val exitCode = process.exitValue()
@@ -270,13 +283,6 @@ abstract class NestedGradleBuild @Inject constructor(
         file.parentFile?.name == "bin"
     }
 
-  private fun gradleExecutableName(): String =
-    if (System.getProperty("os.name").lowercase().contains("windows")) {
-      "gradle.bat"
-    } else {
-      "gradle"
-    }
-
   private fun createGradleUserHome(): File {
     val directory = temporaryDir.resolve("gradle-user-home")
     deleteGradleUserHome(directory)
@@ -294,8 +300,13 @@ abstract class NestedGradleBuild @Inject constructor(
     }
   }
 
-  private companion object {
-    const val GRADLE_STOP_TIMEOUT_SECONDS = 30L
+  companion object {
+    internal fun gradleExecutableName(osName: String = System.getProperty("os.name")): String =
+      if (isWindows(osName)) {
+        "gradle.bat"
+      } else {
+        "gradle"
+      }
   }
 }
 

build-logic/smoke-test/src/main/kotlin/datadog/buildlogic/smoketest/NestedMavenBuild.kt

@@ -0,0 +1,201 @@
+package datadog.buildlogic.smoketest
+
+import org.gradle.api.DefaultTask
+import org.gradle.api.GradleException
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.file.FileTree
+import org.gradle.api.file.RegularFileProperty
+import org.gradle.api.model.ObjectFactory
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.provider.MapProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.CacheableTask
+import org.gradle.api.tasks.IgnoreEmptyDirectories
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFile
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.Internal
+import org.gradle.api.tasks.Nested
+import org.gradle.api.tasks.Optional
+import org.gradle.api.tasks.OutputDirectory
+import org.gradle.api.tasks.PathSensitive
+import org.gradle.api.tasks.PathSensitivity
+import org.gradle.api.tasks.TaskAction
+import org.gradle.jvm.toolchain.JavaLanguageVersion
+import org.gradle.jvm.toolchain.JavaLauncher
+import org.gradle.jvm.toolchain.JavaToolchainService
+import java.io.File
+import java.util.concurrent.TimeUnit
+import javax.inject.Inject
+
+/**
+ * Runs a nested Maven build inside [applicationDir] via the root Maven wrapper.
+ *
+ * The nested build is expected to honour `-Dtarget.dir=<path>` and write outputs under that
+ * directory so Gradle can track the artifact under [applicationBuildDir].
+ */
+@CacheableTask
+abstract class NestedMavenBuild @Inject constructor(
+  private val objects: ObjectFactory,
+  javaToolchains: JavaToolchainService,
+) : DefaultTask() {
+
+  init {
+    javaLauncher.convention(
+      javaToolchains.launcherFor {
+        languageVersion.set(JavaLanguageVersion.of(DEFAULT_NESTED_JAVA_VERSION))
+      },
+    )
+    goals.convention(listOf("package"))
+    arguments.convention(emptyList())
+    environment.convention(emptyMap())
+    mavenOpts.convention("")
+    useMavenLocalRepository.convention(false)
+  }
+
+  @get:Internal
+  abstract val applicationDir: DirectoryProperty
+
+  @get:InputFiles
+  @get:IgnoreEmptyDirectories
+  @get:PathSensitive(PathSensitivity.RELATIVE)
+  val applicationSources: FileTree =
+    objects.fileTree().from(applicationDir).matching {
+      exclude("target/**")
+    }
+
+  @get:OutputDirectory
+  abstract val applicationBuildDir: DirectoryProperty
+
+  @get:InputFile
+  @get:PathSensitive(PathSensitivity.RELATIVE)
+  abstract val mavenExecutable: RegularFileProperty
+
+  @get:InputFiles
+  @get:IgnoreEmptyDirectories
+  @get:PathSensitive(PathSensitivity.RELATIVE)
+  val mavenWrapperFiles: FileTree =
+    objects.fileTree().from(project.rootProject.layout.projectDirectory.dir(".mvn/wrapper")).matching {
+      include("maven-wrapper.properties", "maven-wrapper.jar")
+    }
+
+  @get:Nested
+  abstract val javaLauncher: Property<JavaLauncher>
+
+  @get:Input
+  abstract val goals: ListProperty<String>
+
+  @get:Input
+  abstract val arguments: ListProperty<String>
+
+  @get:Input
+  abstract val environment: MapProperty<String, String>
+
+  @get:Input
+  @get:Optional
+  abstract val mavenOpts: Property<String>
+
+  @get:Input
+  @get:Optional
+  abstract val mavenRepositoryProxy: Property<String>
+
+  @get:Input
+  abstract val useMavenLocalRepository: Property<Boolean>
+
+  /** Timeout, in seconds, for the nested Maven build process. */
+  @get:Input
+  @get:Optional
+  abstract val buildTimeoutSeconds: Property<Long>
+
+  @get:Internal
+  abstract val mavenLocalRepository: DirectoryProperty
+
+  @TaskAction
+  fun runNestedBuild() {
+    val appDir = applicationDir.get().asFile
+    val appBuildDirFile = applicationBuildDir.get().asFile
+    val targetDir = appBuildDirFile.resolve("target")
+    val daemonJavaHome = javaLauncher.get().metadata.installationPath.asFile
+    val command = mavenCommand(mavenExecutable.get().asFile).apply {
+      add("-Dtarget.dir=${targetDir.absolutePath}")
+      if (useMavenLocalRepository.get()) {
+        add("-Dmaven.repo.local=${mavenLocalRepository.get().asFile.absolutePath}")
+      }
+      addAll(arguments.get())
+      addAll(goals.get())
+    }
+
+    val process = ProcessBuilder(command)
+      .directory(appDir)
+      .redirectOutput(ProcessBuilder.Redirect.INHERIT)
+      .redirectError(ProcessBuilder.Redirect.INHERIT)
+      .apply {
+        environment().apply {
+          clear()
+          putAll(nestedEnvironment(daemonJavaHome))
+        }
+      }
+      .start()
+
+    try {
+      val timeoutSeconds = buildTimeoutSeconds.orNull
+      val completed =
+        if (timeoutSeconds == null) {
+          process.waitFor()
+          true
+        } else {
+          process.waitFor(timeoutSeconds, TimeUnit.SECONDS)
+        }
+      if (!completed) {
+        process.destroyForcibly()
+        throw GradleException(
+          "Nested Maven build timed out after $timeoutSeconds seconds: " +
+            command.joinToString(" "),
+        )
+      }
+    } catch (e: InterruptedException) {
+      process.destroyForcibly()
+      Thread.currentThread().interrupt()
+      throw GradleException("Interrupted while running nested Maven build", e)
+    }
+    val exitCode = process.exitValue()
+    if (exitCode != 0) {
+      throw GradleException(
+        "Nested Maven build failed with exit code $exitCode: ${command.joinToString(" ")}",
+      )
+    }
+  }
+
+  private fun nestedEnvironment(daemonJavaHome: File): Map<String, String> {
+    val env = System.getenv().toMutableMap()
+    val repositoryProxy = mavenRepositoryProxy.orNull?.takeIf { it.isNotBlank() }
+    if (repositoryProxy != null) {
+      env["MAVEN_REPOSITORY_PROXY"] = repositoryProxy
+      env.putIfAbsent("MVNW_REPOURL", repositoryProxy.trimEnd('/'))
+    }
+    val opts = mavenOpts.orNull
+    if (!opts.isNullOrBlank()) {
+      env["MAVEN_OPTS"] = opts
+    }
+    env["JAVA_HOME"] = daemonJavaHome.absolutePath
+    env.putAll(environment.get())
+    return env
+  }
+
+  private fun mavenCommand(executable: File): MutableList<String> =
+    if (isWindows()) {
+      mutableListOf("cmd", "/c", executable.absolutePath)
+    } else {
+      mutableListOf(executable.absolutePath)
+  }
+
+  companion object {
+    internal fun mavenWrapperName(osName: String = System.getProperty("os.name")): String =
+      if (isWindows(osName)) {
+        "mvnw.cmd"
+      } else {
+        "mvnw"
+      }
+
+  }
+}

build-logic/smoke-test/src/main/kotlin/datadog/buildlogic/smoketest/OperatingSystem.kt

@@ -0,0 +1,7 @@
+package datadog.buildlogic.smoketest
+
+import java.util.Locale
+
+internal fun isWindows(osName: String = System.getProperty("os.name")): Boolean =
+  osName.lowercase(Locale.ROOT).contains("windows")
+